Marco Berizzi [off-list ref] wrote:

I have removed these modules from
the two boxes that are crashing:

OK, I've matched up your xfrm_output.o with the crash and it
would appear that skb->dst is either NULL or crap after the
local_out call in xfrm_output_resume.  We know that it was valid
before the call because skb->dst is used to make that call.

So it would appear that some netfilter rule has freed skb->dst.
Do you have relevant netfilter rules, e.g., NAT entries or any
rules that might reroute the packet?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt